1. 10 Dec, 2022 6 commits
  2. 08 Dec, 2022 1 commit
  3. 30 Nov, 2022 4 commits
    • Florian Westphal's avatar
      netfilter: conntrack: set icmpv6 redirects as RELATED · 7d7cfb48
      Florian Westphal authored
      icmp conntrack will set icmp redirects as RELATED, but icmpv6 will not
      do this.
      
      For icmpv6, only icmp errors (code <= 128) are examined for RELATED state.
      ICMPV6 Redirects are part of neighbour discovery mechanism, those are
      handled by marking a selected subset (e.g.  neighbour solicitations) as
      UNTRACKED, but not REDIRECT -- they will thus be flagged as INVALID.
      
      Add minimal support for REDIRECTs.  No parsing of neighbour options is
      added for simplicity, so this will only check that we have the embeeded
      original header (ND_OPT_REDIRECT_HDR), and then attempt to do a flow
      lookup for this tuple.
      
      Also extend the existing test case to cover redirects.
      
      Fixes: 9fb9cbb1 ("[NETFILTER]: Add nf_conntrack subsystem.")
      Reported-by: default avatarEric Garver <eric@garver.life>
      Link: https://github.com/firewalld/firewalld/issues/1046Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
      Acked-by: default avatarEric Garver <eric@garver.life>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      7d7cfb48
    • Vishwanath Pai's avatar
      netfilter: ipset: Add support for new bitmask parameter · e9374524
      Vishwanath Pai authored
      Add a new parameter to complement the existing 'netmask' option. The
      main difference between netmask and bitmask is that bitmask takes any
      arbitrary ip address as input, it does not have to be a valid netmask.
      
      The name of the new parameter is 'bitmask'. This lets us mask out
      arbitrary bits in the ip address, for example:
      ipset create set1 hash:ip bitmask 255.128.255.0
      ipset create set2 hash:ip,port family inet6 bitmask ffff::ff80
      Signed-off-by: default avatarVishwanath Pai <vpai@akamai.com>
      Signed-off-by: default avatarJoshua Hunt <johunt@akamai.com>
      Signed-off-by: default avatarJozsef Kadlecsik <kadlec@netfilter.org>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      e9374524
    • Florian Westphal's avatar
      netfilter: conntrack: merge ipv4+ipv6 confirm functions · a70e4834
      Florian Westphal authored
      No need to have distinct functions.  After merge, ipv6 can avoid
      protooff computation if the connection neither needs sequence adjustment
      nor helper invocation -- this is the normal case.
      Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      a70e4834
    • Sriram Yagnaraman's avatar
      netfilter: conntrack: add sctp DATA_SENT state · bff3d053
      Sriram Yagnaraman authored
      SCTP conntrack currently assumes that the SCTP endpoints will
      probe secondary paths using HEARTBEAT before sending traffic.
      
      But, according to RFC 9260, SCTP endpoints can send any traffic
      on any of the confirmed paths after SCTP association is up.
      SCTP endpoints that sends INIT will confirm all peer addresses
      that upper layer configures, and the SCTP endpoint that receives
      COOKIE_ECHO will only confirm the address it sent the INIT_ACK to.
      
      So, we can have a situation where the INIT sender can start to
      use secondary paths without the need to send HEARTBEAT. This patch
      allows DATA/SACK packets to create new connection tracking entry.
      
      A new state has been added to indicate that a DATA/SACK chunk has
      been seen in the original direction - SCTP_CONNTRACK_DATA_SENT.
      State transitions mostly follows the HEARTBEAT_SENT, except on
      receiving HEARTBEAT/HEARTBEAT_ACK/DATA/SACK in the reply direction.
      
      State transitions in original direction:
      - DATA_SENT behaves similar to HEARTBEAT_SENT for all chunks,
         except that it remains in DATA_SENT on receving HEARTBEAT,
         HEARTBEAT_ACK/DATA/SACK chunks
      State transitions in reply direction:
      - DATA_SENT behaves similar to HEARTBEAT_SENT for all chunks,
         except that it moves to HEARTBEAT_ACKED on receiving
         HEARTBEAT/HEARTBEAT_ACK/DATA/SACK chunks
      
      Note: This patch still doesn't solve the problem when the SCTP
      endpoint decides to use primary paths for association establishment
      but uses a secondary path for association shutdown. We still have
      to depend on timeout for connections to expire in such a case.
      Signed-off-by: default avatarSriram Yagnaraman <sriram.yagnaraman@est.tech>
      Reviewed-by: default avatarMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      bff3d053
  4. 22 Nov, 2022 11 commits
  5. 21 Nov, 2022 18 commits